Re: [Doh] [Ext] Re: Associating a DoH server with a resolver

[Paul Hoffman <[e-mail]>]

On Oct 23, 2018, at 6:22 PM, Martin Thomson <[e-mail]> wrote:
> 
> On Wed, Oct 24, 2018 at 12:12 PM Paul Hoffman <[e-mail]> wrote:
>> There is no way for an application like a browser to send a query through the OS for anything other than address records. That is, gethostbyname() and its equivalents only pass back address records. Even if an application had its own DNS stack to make queries for other RRtypes, it doesn't have any way to know where to send them to.
> 
> Well, resolver-addresses.arpa./IN/A(AAA) might still be useful for
> that then.  That's not ideal, but I believe that there are ways to
> make queries for other record types that are more available now than
> perhaps there were in the past (see
> https://docs.microsoft.com/en-us/windows/desktop/api/windns/nf-windns-dnsquery_a
> for example).

I certainly don't want to preclude one-step ways of getting the associated URI templates in a single step, but I also don't want to only have the ability to get associated DoH servers be limited to browsers (because web applications can't call OS APIs), nor limited to browsers that are running on OSes that support sending TXT (or TXT-like) queries. 

> 
>>> IP-based certificates [...] impossible to deploy in many cases (think of the many resolvers with 1918 addresses, for example).
>> 
>> They don't make it "impossible" by a long shot. Plenty of resolvers, even corporate resolvers, have public addresses.
> 
> True, it is probably still possible, but it's not like you can just
> use ACME to get the certificate.  That's "possible" in theory, but I'm
> looking for practicable.

You should be able to use ACME in the future to get an IP-based certificate. draft-ietf-acme-ip has been submitted to the IESG for publication.

--Paul Hoffman